On 2007-06-21T23:45:36, Joshua Brindle <[email protected]> wrote:
> >remember, the policies define a white-list
>
> Except for unconfined processes.
The argument that AA doesn't mediate what it is not configured to
mediate is correct, yes, but I don't think that's a valid _design_ issue
with AA.
> Or through IPC or the network, that is the point, filesystem only
> coverage doesn't cut it; there is no way to say the browser can't access
> the users mail in AA, and there never will be.
We have a variety of filtering mechanisms which are specific to a
domain. iptables filters networking only; file permissions filter file
access only. This argument is not really strong.
<tangent>
If you're now arguing the "spirit of Unix", I can turn your argument
around too: the Unix spirit is to have smallish dedicated tools. If AA
is dedicated to mediating file access, isn't that nice!
AA _could_ be extended to mediate network access and IPC (and this is
WIP). If we had tcpfs and ipcfs - you know, everything is a filesystem,
the Linux spirit! ;-) - AA could mediate them as well.
</tangent>
However, we're discussing the way it mediates file accesses here,
for which it appears useful and capable of functionality which SELinux's
approach cannot provide.
Regards,
Lars
--
Teamlead Kernel, SuSE Labs, Research and Development
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nürnberg)
"Experience is the name everyone gives to their mistakes." -- Oscar Wilde
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
- References:
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
- Re: [AppArmor 39/45] AppArmor: Profile loading and manipulation, pathname matching
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]